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REMARKS 

Applicant has carefully reviewed and considered the Office Action mailed on June 7, 
2007 , and the reference cited therewith. 

Claims 1. 4-6. 9-10. 12. 14-15. 19, 21-22, and 24-25 are amended, claims 2-3.7. 11. 13. 
18, 20, 23, and 26-29 are canceled, and claims 30-36 are added; as a result, claims 1, 4-6, 8-10, 
12, 14-17, 19, 21-22, 24-25, and 30-36 are now pending in this Application, of which claims 1, 
12, 17, 19, and 36 are independent. 

Claim 1 has been amended to recite that the first value, second set of values, third value, 
and fourth set of values are hash values. These amendments find support, for example, on page 
20, line 3, to page 21, line 2 of the specification. Dependent claims 4, 5, 9, and 10 have been 
amended to conform to this amendment. 

Claim 6 has been amended to recite "forwarding the object to an output component" 
instead of "processing the object". This amendment finds support, for example, on page 21, 
lines 26-27 of the specification. 

Claim 12 has been amended to change "first value" and "second value" to "first hash 
value" and "second hash value", respectively. These amendments find support, for example, on 
page 23, line 30, to page 24, line 2, of the specification. Dependent claims 14 and 16 have been 
amended to conform to this amendment 

Claim 19 has been amended to change "first value" and "second set of values" to "first 
hash value" and "second set of hash values", respectively. These amendments find support, for 
example, on page 20, line 3, to page 21, line 2 of the specification. Dependent claims 21, 22, 24, 
and 25 have been similarly amended. 

Claim 30 has been added, which depends on claim 1 and recites that the device which 
previously scans the objects associated with the second and fourth sets of values is the same 
device which receives the object. Support for this claim is found, for example, on page 24, line 
28, to page 25, line 1. 

Claim 3 1 has been added, which depends on claim 1 and recites that the method is 
performed by a firewall. Support for this claim may be found, for example, in original claim 11. 

Claim 32 has been added, which depends on claim 1 and recites that the method is 
performed by a router. Support for this claim may be found, for example, in original claim 1 1 . 
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Claim 33 has been added, which depends on claim 1 and recites "determining whether 
the object is compressed; and if the object is compressed, decompressing the object." Support 
for this claim may be found, for example, on page 19, lines 6-12 of the specification. 

Claim 34 has been added, which depends on claim 17 and recites that the system includes 
a firewall. Support for this claim may be found, for example, in original claim 11. 

Claim 35 has been added, which depends on claim 17 and recites that the system includes 
a router. Support for this claim may be found, for example, in original claim 1 1 . 

Independent claim 36 has been added, which recites a method. Support for this claim 
may be found, for example, on page 23, lines 5-27 of the specification. 
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§ 101 REJECTIONS 

Claims 17-25 and 27-29 were rejected under 35 U.S.C. § 101 as being directed to non- 
statutory subject matter on the ground that software is non-statutory subject matter. Applicant 
respectfully disagrees with this assertion that software is non-statutory subject matter. 

Claim 17 recites: "A system for protecting a device against an exploit, comprising: a 
message tracker that is configured to determine whether an object has been previously scanned 
using a two-phase hash value technique; and a scanner component that is coupled to the message 
tracker and that is configured to receive an unscanned object and to determine whether the 
unscanned object includes an exploit." This claim recites structural interrelationships which 
constitute statutory subject matter. Indeed, MPEP § 2106.01(1) provides: "a claimed computer- 
readable medium encoded with a data structure defines structural and functional 
interrelationships between the data structure and the computer software and hardware 
components which permit the data structure's functionality to be realized, and is thus statutory." 
Therefore, embodiments of claim 17 which may be implemented completely as software are 
statutory subject matter, and Applicant respectfully requests that the rejection of claim 17 be 
withdrawn. 

Claims 19, 21-22, and 24-25, which depend on claim 17, recite patentable subject matter 
for the same reasons as claim 17, and Applicant respectfully requests that the rejections of these 
claims be withdrawn. 

Claims 18, 20, 23, and 27-29 have been canceled, rendering the rejections of these claims 
moot. Accordingly, Applicant respectfully requests that the rejections of these claims be 
withdrawn. 
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§ 112 REJECTIONS 

Claims 4, 5, 14, 15, 21, and 24 were rejected under 35 U.S.C. § 1 12, second 
paragraph. The rejection, which asserts that these claims are incomplete for omitting essential 
elements, on the ground that neither "ROHV" nor "SSHV" were conventional terms of art, and 
that one of ordinary skill in the art of computer science would not know how to produce these 
two computations or values, and which cites MPEP § 2172.01, appears to be a § 112, first 
paragraph rejection based on lack of enablement. "A claim which omits matter disclosed to be 
essential to the invention as described in the specification or in other statements of record may be 
rejected under 35 U.S.C. 112, first paragraph, as not enabling." MPEP § 2172.01. Applicant 
respectfully submits these claims, as understood in light of the specification, do enable one of 
ordinary skill in the art to produce both of these recited values. 

The specification, on page 20, lines 9-14, describes how to produce a rough outline hash 
value (ROHV): "The ROHV is typically determined based on a simple technique that only 
requires a simple computation. For example, the ROHV of an object may be determined from a 
hash value (such as an XOR) hash of the first few bytes or any portion of a file. The ROHV may 
also be determined using simple parameters like the object size and the like. The ROHV enables 
message tracker 527 to roughly distinguish one object from other objects." 

Similarly, the specification, on page 20, lines 16-20, describes how to produce a 
sophisticated signature hash value (SSHV): "An SSHV is typically determined based on a 
sophisticated hash function, such as Message Digest -5 (MD-5), Secure Hash Algorithm (SHA), 
Secure Hash Standard, and the like. The values may also be determined based on a public key 
certificate, a digital signature, a checksum function, or similar algorithmic mechanism that 
provides a value that distinguishes one object from other objects." 

Applicant respectfully submits that these portions of the specification satisfy 35 U.S.C. § 
1 12, first paragraph, by enabling one of ordinary skill in the art to produce a ROHV and a SSHV. 
Accordingly, Applicant respectfully requests that the rejections of claims 4, 5, 14, 15, 21, and 24 
be withdrawn. 

Claim 6 was rejected under 35 U.S.C. § 112, second paragraph, on the ground that 
processing the object without scanning the object was indefinite because processing an object 
inherently necessitates scanning the object. Applicant respectfully submits that the amendment 
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to claim 6, changing "processing" to "forwarding", obviates this rejection. Accordingly, 
Applicant respectfully requests that this rejection be withdrawn. 
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§ 102/103 REJECTIONS 

Claims 1-3, 6-13, 16-20, 22-23, and 25-29 were rejected under 35 U.S.C. § 102(b) as 
being anticipated by, or in the alternative, under 35 U.S.C. § 103(a) as obvious over Chen et al , 
U.S. Patent No. 5,960,170. Applicant respectfully submits that the amendments made to the 
pending claims overcome these rejections. 

Claim 1 has been amended to recite that the values are hash values. Claim 1 was rejected 
on the ground that the virus string Al anticipated the first value recited in claim 1, the virus 
strings Al, A2, and A3 anticipated the second set of values recited in claim 1, the virus string Bl 
anticipated the third value, and that the virus strings Bl, B2, and B3 anticipated the fourth set of 
values. These virus strings are portions of virus signatures. Chen , column 13, lines 27-33. Chen 
does not disclose or suggest determining or matching hash values, as recited in amended claim 1. 
Therefore, Chen does not disclose or suggest all of the elements of amended claim 1, and 
Applicant respectfully requests that the rejection of claim 1 be withdrawn. 

Claims 4-6, 8-10, and 30-33 should be allowed at least due to their dependence on 
allowable claim 1. Claims 9 and 10 should also be allowed for the further reason that Chen does 
not disclose or suggest updating the second set or fourth set to include the third has value or third 
hash value, as recited in claims 9 and 10, respectively. 

Claim 30 should also be allowed because Chen does not disclose or suggest "the second 
set of hash values and the fourth set of hash values are determined by the device based on 
previous scanning by the device", as recited in claim 30. In Chen , the virus detection server 400 
produces the virus strings, and the client 300 executes the vims strings on the object, as shown in 
FIG. 5. Claim 30, on the other hand, recites that the same device determines the sets of hash 
values and determines whether the hash values match the sets of hash values. Therefore, Chen 
does not disclose or suggest the elements recited in claim 30, and Applicant respectfully requests 
that claim 30 be allowed. 

Claims 31 and 32 should also be allowed because Chen does not disclose or suggest a 
method being performed on a firewall or router, respectively. 

Claim 33 should also be allowed because Chen does not disclose or suggest determining 
whether an object has been compressed, or decompressing the object. 
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Claim 12 has also been amended to recite that the values are hash values. Applicant 
respectfully submits that the rejection of claim 12 should be withdrawn because Chen does not 
disclose or suggest including or having hash values, as recited in amended claim 12. 
Accordingly, Applicant respectfully requests that the rejection of claim 12 be withdrawn. 
Applicant further requests that the rejections of claim 16 be withdrawn at least due to claim 16's 
dependence on allowable claim 12. 

Claim 17 recites, in part, "a message tracker that is configured to determine whether an 
object has been previously scanned using a two-phase hash value technique". The Office Action 
asserts that this recitation is disclosed by FIG. 2 of Chen . However, FIG. 2 of Chen , or any part 
of Chen , does not disclose or suggest any hash value technique. Therefore, Chen does not 
disclose or suggest all the elements of claim 17, and Applicant respectfully requests that the 
rejection of claim 17 be withdrawn. 

Applicant further requests that the rejections of claims 19, 22, and 24-25 be withdrawn at 
least due to their dependence on allowable claim 17. 

Applicant further submits that claims 34 and 35 should be allowed due to their 
dependence on allowable claim 17, and because Chen does not recite a system which includes a 
firewall or a router, as recited in claims 34 and 35, respectively. 

Applicant respectfully submits that newly added claim 36 should be allowed because 
Chen does not disclose a rough outline hash value or a sophisticated signature hash value, as 
recited in claim 36. 

Claims 2-3, 7, 11, 13, 18, 20, 23, and 26-29 have been canceled, making the rejections of 
these claims moot. Accordingly, Applicant respectfully requests that the rejections of these 
claims be withdrawn. 
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CONCLUSION 

Applicant respectfully submits that the claims are in condition for allowance and 
notification to that effect is earnestly requested. The Examiner is invited to telephone 
Applicant's attorney (208-286-1013) to facilitate prosecution of this application. 



If necessary, please charge any additional fees or credit overpayment to Deposit Account 
No. 50-3521 and reference Atty Docket No: 0038-005001. 



Respectfully submitted, 

Brake Hughes Bellermann LLP 
Customer Number: 53666 
208-286-1013 



Date May 31. 2007 



Shane A. Kennedy 
Reg. No. 54,760 



